Open data collection for threat intelligence posture assessment
An improved technique involves inputting data in postings from social media or news websites into a risk engine. A posting extraction device continually observes postings aggregated in social media and news websites, such as Twitter, Facebook, CNN, and the like. The posting extraction device parses postings that contain specified keywords such as “credit card,” “account number,” and the like. The posting extraction device also parses these postings for metadata such as user identifiers, times, and locations. The posting extraction device then stores the parsed information in a transaction database that is accessed by an adaptive authentication engine for risk score assignment.
1. A method of employing social media data to improve accuracy of risk-based authentication, the method comprising:
observing, on a continual basis by processing circuitry of a posting extraction device, postings aggregated in a social media forum, said observing including (i) sending, by the posting extraction device, social media access requests to the social media forum to access a set of postings on the social media forum and (ii) searching, by the posting extraction device, the set of postings to identify a user post of a poster, the user post containing any of a set of keywords, each of the set of keywords having a specified impact on a risk score;
extracting, by the posting extraction device, data from the observed postings, the data including posting data from the user post, the posting data including discontinuous event data that includes at least one of the set of keywords and a time when the user post was made; and
assigning, by a risk-based authentication server, risk scores to a set of electronic transactions based on the extracted data, the risk scores being indicative of a risk of fraud in the set of electronic transactions, wherein assigning the risk scores includes, for a particular risk score, (i) computing a first risk score component based on a previous electronic transaction, (ii) computing a second risk score component based on the discontinuous event data, and (iii) producing the particular risk score based on the first risk score component and the second risk score component,
wherein the method further comprises:
storing the posting data from the user post in a transaction database in connection with a user identifier of the poster and further in connection with transaction history information of the poster;
receiving, by the risk-based authentication server after the user post was made, a request to authenticate an electronic transaction, the request to authenticate specifying the user identifier of the poster and a time when the request to authenticate is made; and
in response to the risk-based authentication server determining (a) that the time when the user post was made is more recent than any prior electronic transaction associated with the user identifier in the transaction history information and (b) that the posting data from the user post contains at least one of the set of keywords, (i) assigning a high risk score to the electronic transaction and (ii) preventing the electronic transaction from going forward.
2. The method as in claim 1 , wherein each of the set of electronic transactions includes values of transaction parameters;
wherein each of the observed postings includes metadata, the metadata including values of posting parameters;
wherein the method further comprises:
extracting the metadata of the observed postings; and
storing the values of the posting parameters in the transaction database; and
wherein assigning the risk scores includes:
accessing the values of the posting parameters stored in the transaction database.
3. The method as in claim 2 , wherein the values of the posting parameters of the metadata of a posting include the user identifier; and
wherein storing the values of the posting parameters in the transaction database includes:
placing the values of the posting parameters in a location in the transaction database according to the user identifier.
4. The method as in claim 2 , wherein assigning the risk scores to the set of electronic transactions further includes:
performing a comparison operation on a value of a transaction parameter of an electronic transaction of the set of electronic transactions with a value of a posting parameter of the set of posting parameters of the extracted metadata, and
generating the particular risk score based on a result of the comparison operation.
5. The method as in claim 4 , wherein performing the comparison operation includes:
comparing the time when the user post was made with the time when the request to authenticate was made to produce a time difference, the particular risk score being based on the time difference.
6. The method as in claim 4 , wherein the values of the posting parameters of the metadata of a posting include a geolocation indicating a location where the posting was introduced into the social media forum;
wherein performing the comparison operation includes:
comparing the value of the geolocation of the posting with a geolocation at which an electronic transaction was initiated to produce a location difference, the particular risk score being based on the location difference.
7. The method as in claim 1 , further comprising:
performing sentiment analysis on the set of keywords, a result of the sentiment analysis being one of a negative sentiment and a positive sentiment, the negative sentiment indicating an environment in which the risk of fraud in the electronic transaction is high, the positive sentiment indicating an environment in which the risk of fraud in the electronic transaction is low; and
wherein assigning the risk scores includes:
generating the particular risk score based on the result of the sentiment analysis.
8. The method as in claim 1 , wherein computing the first risk score component includes:
obtaining previous values of a transaction factor associated with the user identifier;
obtaining a new value of the transaction factor from the request to authenticate the electronic transaction; and
producing, as the first risk score component, a number indicating a likelihood that the transaction factor would have the new value given that the transaction factor has had the previous values,
wherein each of the observed postings includes metadata, the metadata including values of posting parameters;
wherein computing the second risk score component includes:
extracting the metadata of the observed postings;
accessing the values of the posting parameters from the metadata; and
producing, as the second risk score component, a number indicating a likelihood that the electronic transaction is fraudulent based on the values of the posting parameters, and
wherein producing the particular risk score based on the first risk score component and the second risk score component includes forming a sum of the first risk score component and the second risk score component.
9. The method as in claim 1 , wherein the set of keywords includes a word or phrase associated with an occurrence of a discontinuous event which increases a risk of fraud and which cannot be detected based solely on post time and location.
10. A computer program product having a non-transitory, computer-readable storage medium that stores instructions which, when executed by a controller, cause the controller to carry out a method of employing social media data to improve accuracy of risk-based authentication, the method comprising:
observing, on a continual basis by processing circuitry of a posting extraction device, postings aggregated in a social media forum, said observing including (i) sending, by the posting extraction device, social media access requests to the social media forum to access a set of postings on the social media forum and (ii) searching, by the posting extraction device, the set of postings to identify a user post of a poster, the user post containing any of a set of keywords, each of the set of keywords having a specified impact on a risk score;
extracting, by the posting extraction device, data from the observed postings, the data including posting data from the user post, the posting data including discontinuous event data that includes at least one of the set of keywords and a time when the user post was made; and
assigning, by a risk-based authentication server, risk scores to a set of electronic transactions based on the extracted data, the risk scores being indicative of a risk of fraud in the set of electronic transactions, wherein assigning the risk scores includes, for a particular risk score, (i) computing a first risk score component based on a previous electronic transaction, (ii) computing a second risk score component based on the discontinuous event data, and (iii) producing the particular risk score based on the first risk score component and the second risk score component,
wherein the method further comprises:
storing the posting data from the user post in a transaction database in connection with a user identifier of the poster and further in connection with transaction history information of the poster;
receiving, by the risk-based authentication server after the user post was made, a request to authenticate an electronic transaction, the request to authenticate specifying the user identifier of the poster and a time when the request to authenticate is made; and
in response to the risk-based authentication server determining (a) that the time when the user post was made is more recent than any prior electronic transaction associated with the user identifier in the transaction history information and (b) that the posting data from the user post contains at least one of the set of keywords, (i) assigning a high risk score to the electronic transaction and (ii) preventing the electronic transaction from going forward.
11. The computer program product as in claim 10 , wherein each of the set of electronic transactions includes values of transaction parameters;
wherein each of the observed postings includes metadata, the metadata including values of posting parameters;
wherein the method further comprises:
extracting the metadata of the observed postings; and
storing the values of the posting parameters in the transaction database; and
wherein assigning the risk scores includes:
accessing the values of the posting parameters stored in the transaction database.
12. The computer program product as in claim 11 , wherein the values of the posting parameters of the metadata of a posting include the user identifier; and
wherein storing the values of the posting parameters in the transaction database includes:
placing the values of the posting parameters in a location in the transaction database according to the user identifier.